Infrastructure
Bunker infrastructure includes the physical resources that host your managed services.
Overview
Infrastructure is organized in three levels:
- Datacenters - Physical data centers in Europe
- Networks - Connectivity and isolation
- Storage - Data persistence
Architecture
Datacenters
All Bunker datacenters are located in Europe, in two regions in France:
- France Ouest (
fr-ouest-1): four data centers operated by Bunker, three of them fully in-house. This is the default region. - Paris (
fr-idf-1): three sites hosted by Scaleway, as a hosting subcontractor, accessible on authorisation only.
| Region | Datacenter | Location | Compliance |
|---|---|---|---|
| France Ouest | DC01 | Les Essarts-en-Bocage (Vendée, France) | Sovereign France, GDPR compliant |
| France Ouest | DC02 | Rennes (Ille-et-Vilaine, France) | Sovereign France, GDPR compliant |
| France Ouest | DC03 | Nantes (Loire-Atlantique, France) | Sovereign France, GDPR compliant |
| France Ouest | DC04 | Challans (Vendée, France) | Sovereign France, GDPR compliant |
| Paris | DC05-1 to DC05-3 | Île-de-France (France), at Scaleway | Sovereign France, GDPR compliant |
Characteristics
Everything listed below applies to the France Ouest region. The physical security of the Paris region sites falls to Scaleway, under our supplier policy.
- Power: N+1 redundancy
- Cooling: Free cooling + air conditioning
- Security: Biometric access, 24/7 video surveillance
- Network: Multiple carriers, low latency
Networks
Isolation between customers
A customer's managed service instances run in their own Kubernetes namespaces, attached to their tenant and subject to quotas. The network security policy governs the segregation between tenants.
Inter-DC connectivity
The France Ouest region datacenters are interconnected through two complementary encryption layers:
- IPsec tunnels between each DC pair, leveraging hardware-accelerated AES encryption (AES-NI)
- Headscale (built on WireGuard with ChaCha20-Poly1305 encryption) for Zero Trust networking and access management
Public Network
Managed services reachable from the Internet sit behind the Bunker zero-trust edge. The public IP addresses of each platform are published.
Storage
Bunker uses Ceph for distributed storage:
| Type | Usage | Performance |
|---|---|---|
| SSD NVMe | System, databases | Ultra-fast |
| HDD | Archives, backups | Economical |
Characteristics
- Replication: Minimum 3 copies
- Encryption: In transit and at rest on the storage layer
- Snapshots: Instant snapshots for backup
Data Location
In accordance with our sovereignty commitment:
- All data stays in Europe
- No replication abroad
- Hosting under European jurisdiction
Next Steps
- Hypervisors - Understand virtualization
- Control Plane - Understand the platform API